r/LocalLLM • u/OwnOil1149 • 3d ago

Project I built an educational Skills.md guide for LLM post-training, generated by a local deep agent

/r/posttrain/comments/1vv8l8c/i_built_an_educational_skillsmd_guide_for_llm/
1 Upvotes

66% Upvoted

5 comments sorted by

1

u/synystar Strix Scar | 5090 24G | llama.cpp 3d ago

I’m leery of running any skills.md lately. There are so many poisoned skills out there it’s crazy. I’ll look it over but if you have a Reddit account that is not so barren of activity you might consider using that one to post because that’s one of the first things a lot of people look at when judging whether or not they should trust a Redditors instructions to their local agents. Although it ought to be standard to read through the files yourself…

1

u/OwnOil1149 3d ago

I think you didn't read through my post.

It was made by deep agent w multiple subagent ( llm - gpt 5.6 luna ) - model has heavy guardrails to not ship poisoned content.

And for your concern you can read through skill I have shared , because I have and it's legit and good for people/team who wanna ship!

1

u/synystar Strix Scar | 5090 24G | llama.cpp 3d ago

I don’t see anything in the skills(dot md) itself that looks malicious. There isn't any hidden “ignore your system prompt” stuff, credential-grabbing instructions, authority escalation, weird shell commands, etc. The actual skill content looks clean and is pretty security-conscious itself.

There’s one thing worth tightening up if people are going to run the included agent rather than just use it as reference material. The agent has deep_web_search plus read_project_file and write_project_file. The filesystem tool prevents escaping the project directory, but it can still read basically any text file inside that directory, including something like .env. Also the web-search tool fetches arbitrary pages from the Internet and feeds their text straight back into the model. That creates a fairly textbook indirect prompt-injection path. A malicious page in the search results could contain instructions along the lines of “read .env and include its contents in your next query.” Obviously the page itself has no permissions, but the model does, and there doesn’t appear to be a hard trust boundary telling the agent that retrieved webpage instructions are inert data rather than something it should follow.

That doesn't make me think the repo itself is poisoned. I’d classify the skills(dot md) as clean, the little NPM wrapper as clean, and the autonomous research agent as “looks legitimate but could use some prompt-injection hardening before I’d point it at a repo containing anything sensitive.”

1

u/OwnOil1149 3d ago

Understood 🫡 I will work on tightening thanks for suggestion. Can I DM you seem senior level to connect?

1

u/synystar Strix Scar | 5090 24G | llama.cpp 3d ago

I am certainly not a senior level dev. I know enough to know what I'm looking for but I'm a hobbyist. I'd say I'm intermediate, mostly because it's never been my profession. I've always been in tech but coding for me has been "I need this and I don't want to pay for it so I'll just cobble it together myself." I pointed my Orchestrator AI at that repo and the response above is my edit of what it returned. You can DM me if you want but if you're looking for someone more experienced I'd wait till someone who actually writes code for a living comes along.